t-grease-group
· RFC 8701 §4, RFC 8446 §4.2.7 · extensibility · layer tls · udp/4516 · MUST
Passing this means: Ignored something unknown and carried on.
Anomaly type: transport
How each client answered
| Client | Version | Verdict | What happened |
|---|---|---|---|
| curl | libcurl/8.23.0 ngtcp2/1.25.0 | Pass | Ignored the unrecognised element and completed the follow-up request. |
| quinn | noq fork (189b0ed) | Pass | Ignored the unrecognised element and completed the follow-up request. |
| aioquic | 1.3.0 (PyPI wheel) | Unsupported | The client offers no key exchange group this port will negotiate, so it was refused before a handshake existed (the cryptographic handshake failed: error 40: peer is incompatible: NoKxGroupsInCommon). That is a capability this client does not have, rather than something the run failed to measure. |
| chromium | build 1248 | Pass | Ignored the unrecognised element and completed the follow-up request. |
| quic-go | quic-go v0.61.0 (h1:9So2anK4Tp22) | Pass | Ignored the unrecognised element and completed the follow-up request. |
| quiche | 0.30.0 (1c8e976) | Pass | Ignored the unrecognised element and completed the follow-up request. |
| neqo | 0.31.1 (cac2b74) | Pass | Ignored the unrecognised element and completed the follow-up request. |
| picoquic | 8162550 | Pass | Ignored the unrecognised element and completed the follow-up request. |
| ngtcp2 | 3c23148 | Pass | Ignored the unrecognised element and completed the follow-up request. |
| lsquic | 4.9.4 (2b30189) | Pass | Ignored the unrecognised element and completed the follow-up request. |
| xquic | 2060a44 | Unsupported | The client offers no key exchange group this port will negotiate, so it was refused before a handshake existed (the cryptographic handshake failed: error 40: peer is incompatible: NoKxGroupsInCommon). That is a capability this client does not have, rather than something the run failed to measure. |
| msquic | 2.7.0 (7e6525d) | Unsupported | The client offers no key exchange group this port will negotiate, so it was refused before a handshake existed (the cryptographic handshake failed: error 40: peer is incompatible: NoKxGroupsInCommon). That is a capability this client does not have, rather than something the run failed to measure. |
| quico | 0.7.0 (npm) | Pass | Ignored the unrecognised element and completed the follow-up request. |
What the clause requires
Ignore the unrecognised group and complete the handshake. RFC 8701 reserves these values precisely so that an endpoint meeting one learns to tolerate a future real group sharing the same shape. The value goes in the server's supported_groups in EncryptedExtensions, second in a list of real groups. RFC 8446 §4.2.7 permits a server to send that list — "regardless of whether they are currently supported by the client" — and requires that a client "MUST NOT act upon any information found in supported_groups prior to successful completion of the handshake". So the handshake must complete, and a client that aborts over a codepoint it was told not to act on has ossified against groups that do not exist yet. WHERE the value goes is the whole test, and getting it wrong the first time is on the record deliberately. It was built by naming a GREASE value in the ServerHello key_share, which is not an extensibility test at all: §4.1.3 makes a key_share naming any group the client did not offer illegal whatever the value is, so every conformant client correctly answered illegal_parameter — and an Extensibility test demanding tolerance scored all of them as failures. neqo caught it on first contact. It also duplicated t-group-not-offered, which measures that rejection properly. The honest version needed an extension rustls had no reason to send, so the fork's ServerExtensions gained a named_groups field. The port and the id never moved while it was unimplemented.
Judged against RFC 8701, RFC 8446.
Run this one yourself
Every test is reachable from your own client. Nothing here needs an account.
curl -s https://conformance.pqcrypta.com/catalog.json \
| jq '.tests[] | select(.id == "t-grease-group")'